tegwick
3abee434df
Select service-jwt, bootstrap, or env exclusively: JWT login uses a JSON file, self-revokes, and never falls back to bootstrap or BAO_TOKEN. The platform JWT mount/role is still unpublished, so auto keeps named bootstrap/env providers. session revoke --accessor-file revokes an already-issued token with fingerprint-only evidence. Production remains fail-closed. Assistant: grok Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
23 lines
967 B
Markdown
23 lines
967 B
Markdown
# OpenBao JWT login contract (engine consumer)
|
|
|
|
Steady-state engine authentication is the reviewed KeyCape
|
|
`secrets-engine-openbao` identity plus a **platform-owned** OpenBao JWT auth
|
|
mount and exact-bound role. This repository does not invent that mount.
|
|
|
|
Point `SECRETS_ENGINE_OPENBAO_JWT_LOGIN` at a mode-normal YAML file outside
|
|
the need to hold a standing OpenBao token:
|
|
|
|
```yaml
|
|
mount: jwt
|
|
role: secrets-engine
|
|
bound_issuer: https://<keycape-issuer>
|
|
```
|
|
|
|
`bound_issuer` must equal `SECRETS_ENGINE_KEYCAPE_ISSUER`. The JWT is sent
|
|
through a temporary JSON file, never argv. The resulting OpenBao token is
|
|
revoked at the end of the command (`token revoke -self`). Evidence records
|
|
the provider name and an accessor fingerprint only.
|
|
|
|
Until railiance-platform publishes that file, `--auth auto` keeps the named
|
|
bootstrap-file and `BAO_TOKEN` providers. `--auth service-jwt` fail-closes.
|
|
A service-jwt selection never reads `--bootstrap-token-file` or `BAO_TOKEN`.
|